AI in Governance: What Actually Works

What AI is genuinely good at here

The useful applications are unglamorous and they all share one trait: the AI proposes, and a person disposes.

• Summarising a week of exceptions into something a committee can read in five minutes.
• Spotting patterns across variants that nobody had time to look for.
• Drafting the first version of a rule, a risk statement, or a control description.
• Explaining a framework practice or objective in the language of your organisation.

Where it goes wrong

Every failure we see in the field falls into one of four buckets, and none of them are fixed by a better model.

• Unattributed output — an AI-drafted conclusion that ends up in a board pack with no label.
• Confidence without provenance — a plausible number that nobody can trace to a source.
• Silent scope creep — a tool that started as a summariser and quietly became an approver.
• Data leakage — operational detail pasted into an ungoverned tool.

The operating pattern that works

One pattern covers almost every safe use: label, score, hold, approve, log.

• Label every AI-generated artefact as AI-generated, wherever it appears.
• Attach a confidence score and the metrics the suggestion was derived from.
• Hold it in a pending state — nothing reaches a report until a person accepts it.
• Record who approved it, when, and what they changed.

Questions from the session

Does the AI ever act on its own? Not in a governance context. Actions are automations with explicit rules; AI drafts the case for change, people authorise it.

How do we handle a wrong suggestion? Reject it with a reason. Rejections are as valuable as approvals because they are the record that review is real.

What about the regulator? Show them the log. A labelled, scored, human-approved trail is a far stronger position than claiming no AI was involved.